Bug 17509 - Segfault / out of bounds access in strings
Summary: Segfault / out of bounds access in strings
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: 2.24
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL: https://sourceware.org/git/?p=binutil...
Depends on:
Reported: 2014-10-24 11:41 UTC by Hanno Boeck
Modified: 2014-10-24 16:21 UTC (History)
1 user (show)

See Also:
Last reconfirmed:

strings crasher 1 (107 bytes, application/octet-stream)
2014-10-24 11:41 UTC, Hanno Boeck
strings crasher 2 (13 bytes, text/plain)
2014-10-24 11:41 UTC, Hanno Boeck

Note You need to log in before you can comment on or make changes to this bug.
Description Hanno Boeck 2014-10-24 11:41:24 UTC
Created attachment 7844 [details]
strings crasher 1

Attached are two samples that cause the strings tool to segfault. The first one has been found by Michal Zalewski and postet on twitter:

Here's how he described the issue on oss-security:
"The immediate cause is due to srec_scan() in srec.c decreasing 'bytes'
without range checking until it wraps around. The already-bad value of
'bytes' is assigned to 'sec->size' few lines before the crash, so
perhaps there would be potential for exploitability later down the
line; but the code ends up crashing soon thereafter in a 'while (bytes
> 0)' loop that has no other exit conditions. That loop would need to  
go over the entire address space without SEGV to avoid the crash."

In reply to that someone else postet another crasher to oss-security that seems to expose a different code path.

Here's the corresponding thread:
Comment 1 Hanno Boeck 2014-10-24 11:41:49 UTC
Created attachment 7845 [details]
strings crasher 2
Comment 2 Mike Frysinger 2014-10-24 16:21:18 UTC
this was already fixed months ago and is included in the pending 2.25 release